Patch Management All workstations, laptops and other systems that process and/or 22 store PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or 23 transmits on behalf of COUNTY must have critical security patches applied, with system reboot if 24 necessary. There must be a documented patch management process which determines installation 25 timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable 26 patches must be installed within thirty (30) calendar or business days of vendor release. Applications 27 and systems that cannot be patched due to operational reasons must have compensatory controls 28 implemented to minimize risk, where possible.
Information Management Information and Records